#!/bin/sh
#
#    Copyright (C) 2009  Vitaly Druzhinin
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

### BEGIN INIT INFO
# Provides:             flex-fw
# Required-Start:       $local_fs $syslog
# Required-Stop:        $local_fs $syslog
# X-Start-Before:       sshguard
# Default-Start:        2 3 4 5
# Default-Stop:         0 1 6
# Short-Description:    flex-fw firewall system
### END INIT INFO

FLEXFW=/usr/sbin/flex-fw

#
# See how we were called.
#
case "$1" in
    start)
        echo -n "Start flex-fw firewalling system: "
        $FLEXFW start
        if [ $? -eq 0 ]; then
            echo "Ok."
        else
          echo "fail!"
        fi
    ;;

    stop)
        echo -n "Stop flex-fw firewalling system: "
        $FLEXFW stop
        if [ $? -eq 0 ]; then
            echo "Ok."
        else
            echo "fail!"
        fi
    ;;

    restart)
        echo -n "Stop flex-fw firewalling system: "
        $FLEXFW stop
        if [ $? -eq 0 ]; then

            echo "Ok."
            sleep 1

            echo -n "Start flex-fw firewalling system: "
            $FLEXFW start
            if [ $? -eq 0 ]; then
                echo "Ok."
            else
                echo "fail!"
            fi

        else
            echo "fail!"
        fi
    ;;

    reload)
        echo -n "Reload flex-fw rules: "
        $FLEXFW reload
        if [ $? -eq 0 ]; then
            echo "Ok."
        else
            echo "fail!"
        fi
    ;;

    safemode)
        if [ -z "$2" ]; then
            TIMEOUT=60
        else
            TIMEOUT=$2
        fi
        echo -n "Start flex-fw in safe mode: "
        $FLEXFW start
        if [ $? -eq 0 ]; then
            echo "Ok."
            cat <<END_OF_MESSAGE

Now flex-fw is running in the safe mode. After $TIMEOUT seconds timeout all iptables filtering rules
will be flushed and default policy will be set to ACCEPT. This allow you to fix possible problems
with flex-fw settings and try again later.

END_OF_MESSAGE
            sleep $TIMEOUT
            echo "Flush iptables filter"

            iptables -P INPUT ACCEPT
            iptables -P OUTPUT ACCEPT
            iptables -P FORWARD ACCEPT

            iptables -F INPUT
            iptables -F OUTPUT
            iptables -F FORWARD

            iptables -t nat -F PREROUTING
            iptables -t nat -F POSTROUTING
            iptables -t nat -F OUTPUT

            iptables -t mangle -F PREROUTING
            iptables -t mangle -F POSTROUTING
            iptables -t mangle -F INPUT
            iptables -t mangle -F OUTPUT
            iptables -t mangle -F FORWARD

        else
            echo "fail!"
            echo "Flush iptables filter"

            iptables -P INPUT ACCEPT
            iptables -P OUTPUT ACCEPT
            iptables -P FORWARD ACCEPT

            iptables -F INPUT
            iptables -F OUTPUT
            iptables -F FORWARD

            iptables -t nat -F PREROUTING
            iptables -t nat -F POSTROUTING
            iptables -t nat -F OUTPUT

            iptables -t mangle -F PREROUTING
            iptables -t mangle -F POSTROUTING
            iptables -t mangle -F INPUT
            iptables -t mangle -F OUTPUT
            iptables -t mangle -F FORWARD

        fi
    ;;

    *)
        echo "Usage: $0 {start|stop|restart|reload|safemode [timeout]}"
        exit 0
esac

# end of file
